CVE-2026-16597 is a stored cross-site scripting vulnerability in the GTM4WP – A Google Tag Manager plugin for WordPress, affecting all versions up to and including 1.22.3. The vulnerability occurs due to improper neutralization of input in WooCommerce billing fields when the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) is enabled. This allows unauthenticated attackers to inject arbitrary JavaScript payloads via guest checkout orders, which execute when users access the injected pages. The CVSS 3.1 base score is 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. The vulnerability requires the WooCommerce order data integration option to be enabled and is triggered via guest checkout orders with malicious billing field input.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) if enabled, to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.